Contracts with the cloud provider conform to the approved cloud computing policy and state at least the provider's name, parent company, business address and full contact details; the activities and services assigned; the contract duration; the provider's commitment to keep the company's data confidential, private and secure and to honour the company's business continuity plans; the audit and supervisory measures over the provider; the standards for performance, operation, internal control and risk management; the service level agreement and what performance the provider must deliver; what each party is responsible for; dispute resolution; the reporting mechanism to the company; the governing law; the legal and regulatory arrangements the provider follows; technical and maintenance support requirements; penalty clauses for failure to provide the services; and renewal and renegotiation rights that let the company keep adequate supervision of the arrangement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.